CVE-2026-42356: apache software foundation apache http server Deployment of Wrong Handler
Vulnerability summary
CVE-2026-42356 is a low (CVSS 3.7) Deployment of Wrong Handler vulnerability in apache software foundation apache http server. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 01-10-2026PublishedVulnerability first disclosed.
- 01-10-2026Last modifiedVulnerability information updated.
Description
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- apache2< 2.4.69-r0
Apache1 product
- http_server≥ 2.4.0, < 2.4.69
Apache software foundation1 product
- apache http server≥ 2.4.60, ≤ 2.4.68
Debian1 product
- apache2All versions (No fix recorded) | < 2.4.69-1~deb13u1 | < 2.4.69-1
Ubuntu1 product
- apache2All versions (No fix recorded)
5 vendors · 5 products
